Getting Data In

Using sedcmd to truncate QPM=

New Member

Hi Everyone,

Wondering if anyone has a solution to an issue I'm having truncating out some values we deem to be "junk".

We have Splunk indexing logs from AD security and I have the below sedcmd configured:

SEDCMD-shorternQPM = s/(.*QPM.*).*//g

Post restarting the indexer service I couldn't see any noticeable difference in the output.

Below is a snippet of the line where QPM exists:

QPM=

Tags (2)
0 Karma

Revered Legend

Are you looking to truncate part of your raw data or just drop the whole event itself (no indexing)? If it's the latter, I would suggest reading/implementing this:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Routeandfilterdatad#Filter_event_data_...

Your sample data and configuration entries will get truncated if you do not format them using "100010" button on top of the text editor in this page (or select and press Ctrl+K).

0 Karma

New Member

Hi Everyone,

Apologies, appears I hit a character limit.

We need most of the log file and need to omit a small component of it.

An example of a line we are attempting to clean can be seen below:

QPM=<root> <QPM id="the-one"> <public> <Options> <param name="sprPrmLockCount" value="2" /> <param name="sprPrmLockTimestamp" value="11.06.2016 20:36:31" /> <param name="sprPrmLocked" value="no" /> <param name="Layout" value="M|M|M|M|M" /> <param name="sprAnswersHashed" value="no" /> <param name="sprForceEnrollStartDate" /> <param name="sprInvalidQAProfile" value="no" /> <param name="sprLID" value="en" /> <param name="sprShortestAnswerSize" value="5" /> </Options> </public>

Any help is much appreciated

0 Karma

SplunkTrust
SplunkTrust

What part do you need to omit?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

All of it from QPM to the end of the line

0 Karma

SplunkTrust
SplunkTrust

You don't say which "QPM", but (QPM.*) should match everything from the first one.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

You didn't give us much to work with.

The SEDCMD string is expecting a single character before "QPM", but the sample data has no such character. That's one possible explanation for the failure.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!